Stuntdbl has covered off many of the points that would make sense.
I think looking at how Google (or any PPC for that matter) is one thing, but it tends to be more what we do to raise the matter for investgation and the documentation to provide that matters.
We tend to look at analytics a lot more, run custom reports and look at visits that last less than 10 seconds, where the originating click was from a PPC visit.
We'll look at inconsistent publishing sources, in comparison to others. By that if publisher x, y and z convert clicks to leads/sales/actions at say 3% and publisher a does so at 0.3% it may warrant a look. Same keywords, title, description and landing page should get broadly similar results.
Foreign country IP ranges where the product/service woudl not be relevant (although I blame the advertisers in that scenario for using Global as the target audience).
The keyword used would be the same more often than not.
I pay a lot of attention to what my competitors are up to.
On occasions, I will have clicked an ad because I wanted to see a strategy (deep linked vs. non/ relevancy etc.). In an ideal world I'd like to come clean and register our IP addresses as an agency and not have them count but that would be utopia. In the meantime....
I can't see the scenario above being any different to picking up a sales promotional brochure at a conference or ehxibition, when I have no intention of buying but am curious on pricing, model etc.. They will have paid for the production costs of the material. That's just business.
We always try to factor in a "noise" level before we launch an investigation. Often the cost of the investigation may be more than the budget lost. The noise level will vary depending on volume of clicks, CPC, objectives, target CPA and others.
I think just using ROI as your barometer and flagging abnormalities with the relevant supporting documentation makes the refunding process easier.
If PPC providers don't take action then the advertisers will vote with their credit cards. PPC providers do take this matter serious. We've received many refunds, often without even having to provide documentation, so it does get picked up, often days/weeks after the event.
At the very least it may get a rogue publisher, or entrepreneurial labour sweat shops flushed out of the system and will ensure that Google et al are kept true.
If a competitor is smart then there will be no obvious trail back to them. If they are that dumb in leaving the trail and that quiet that all they can do is click your ads then rejoice, they will not be around for long.
Dial up would be used, which would mean a lot of visits from the same ISP.
If in doubt flag your concerns.